Posted
by
Soulskill
on Wednesday January 02, 2013 @08:11AM
from the also-can't-hold-its-own-against-the-protoss dept.

Hugh Pickens writes "Nicole Perlroth reports in the NY Times that the antivirus industry has a dirty little secret: antivirus products are not very good at stopping new viruses. Researchers collected and analyzed 82 new computer viruses and put them up against more than 40 antivirus products, made by top companies like Microsoft, Symantec, McAfee and Kaspersky Lab and found that the initial detection rate was less than 5 percent (PDF). 'The bad guys are always trying to be a step ahead,' says Matthew D. Howard, who previously set up the security strategy at Cisco Systems. 'And it doesn't take a lot to be a step ahead.' Part of the problem is that antivirus products are inherently reactive. Just as medical researchers have to study a virus before they can create a vaccine, antivirus makers must capture a computer virus, take it apart and identify its 'signature' — unique signs in its code — before they can write a program that removes it. That process can take as little as a few hours or as long as several years. In May, researchers at Kaspersky Lab discovered Flame, a complex piece of malware that had been stealing data from computers for an estimated five years. 'The traditional signature-based method of detecting malware is not keeping up,' says Phil Hochmuth. Now the thinking goes that if it is no longer possible to block everything that is bad, then the security companies of the future will be the ones whose software can spot unusual behavior and clean up systems once they have been breached. 'The bad guys are getting worse,' says Howard. 'Antivirus helps filter down the problem, but the next big security company will be the one that offers a comprehensive solution.'"

It's much much worse than that... A human virus has to get really lucky and accidentally evolve features necessary to bind to our receptor sites. Virus authors, on the other hand, can use virustotal.com to see who can detect their stuff and evolve as necessary to avoid detection.

Virus authors, on the other hand, can use virustotal.com to see who can detect their stuff and evolve as necessary to avoid detection.

Virus writers make their viruses evolve? Creationism, anyone? Computer viruses don't evolve, they are engineered/programmed. And viruses that attack animals (including humans) don't have to evolve features necessary to bind to our receptor sites, those features have already evolved. What they do is mutate so that the animal's immune system doesn't recognize it as a threat.

The animal immune system is nothing whatever like computer antivirus, and animal viruses are nothing like computer viruses. You guys are anthropomorphising WAY too much here.

In a sense, yes. Viruses have been created which "evolve" by changing their code around in order to prevent signature based detection. Viruses that do that are referred to as polymorphic [wikipedia.org] viruses.

Polymorphic viruses are doing basically the same thing as a biological species that evolves into a different coloring that helps it hide from predators. The ones that don't evolve better camouflage get eaten by predators/cleaned by virus scanners. The ones that do evolve better camouflage spread.

Computer code, like a dna strand, is binary data. One uses electrical states for 1s and 0s, the other uses base pairs (A-T, C-G). DNA mutations are changes in basepairs, sometimes caused by radiation, and computer code can likewise be altered (ones flipped to zeros) by cosmic / background EM radiation-- thats a good part of the reason servers use ECC RAM.

Try "corruption" instead. Does random corruption of code seem like a good way to generate anything useful? Did hard disk corruption ever improve a computer program? How about a stick of bad RAM? Did that ever make your operating system run better?

Evolution applies to ANY imperfectly self-replicating structure whose fitness to replicate varies with that structure. It is not restricted to life. Self-modifying viruses would absolutely qualify as evolving, if that's what they're referring to here.

How the process of change is implemented is irrelevant to evolution. Evolution means that in response to challenges of the environment, lesser fit forms die off and fitter forms proliferate. By some process of change, the fittest forms continue to keep apace of environmental shifts. Nobody ever stipulated that the hand of change had to be random chance mutation in a particular sort o

If you want to get technical, a bio-hazardous virus (it's not an animal in any sense at all - debatable that it is even what you'd consider living matter) splices its RNA payload into a cell, which reprograms it to transcript more viruses and fewer organelles (destroying the cell in the process,) which then spread to inject their RNA into other cells ad infinitum.

A computer virus splices its code payload into another executable program that it finds, causing the program to do repeat the process in addition

It's not really like the immune system. The immune system works on several levels, but the main strategy is to start with a rough full coverage blacklist from which all the whitelist items have been removed. When you get in contact with antigens, there are instant matches with the blacklist but they aren't very powerful. You proceed by making variations around the matching blacklist items and upgrade the best matches till you get a good powerful response. This upgraded blacklist is then ready for a fast pow

As the bad guys are always ahead! It's trivial!
The antivirus company can only react to new virus technologies. So the time to reaction is the actual measurement we need first. Only later we need the accuracy.

I'm not sure what "comprehensive solution" is being called for. Antivirus is an undecidable problem; the best we can ever do is check for what we know to date, and add some guesswork for finding future malware. But we will never have a perfect antivirus program.

The better solution has proven to be OS security locks. Like it or not, the walled-garden approach implemented by Apple in iOS--and more recently by Microsoft--has made it much more difficult for malware to actually do anything harmful to your dat

I thought I've seen some pattern detection stuff in AVs before, that was supposed to try to detect suspicious activity.

Problem is, there are a lot of legitimate things that look suspicious. Writing a predictive scanner is an even more difficult task than getting the base OS secure without losing too much performance, usability, or user friendliness.

Solving the AV problem is harder than solving the "Halting Problem", since you aren't given the full source and inputs. Sandboxing and similar is the better approach.

In many cases if you do things right (esp on servers), AV software is more likely to cause problems than viruses. Every now and then you hear of an AV software with a system crippling false positive or other big problem. So if you are sandboxing stuff, and not regularly adding 3rd party software to a server or browsing with it, installing AV software on servers is more likely to cause problems than it'll ever solve.

I thought I've seen some pattern detection stuff in AVs before, that was supposed to try to detect suspicious activity.

Problem is, there are a lot of legitimate things that look suspicious. Writing a predictive scanner is an even more difficult task than getting the base OS secure without losing too much performance, usability, or user friendliness.

Actually it seems like my scanner likes to just flag on stuff with packed payloads, like compression is a new thing. Or utils, like unlocker. And some cracked files. My Antivirus ever finding a virus? Nope. Malwarebytes Anti-Malware seems to find more stuff though, but I guess Malware isn't Viruses, though I want neither on my computer and requires 2 programs.

So I have an anti-virus program that doesn't nothing good, but has a "shield" and a Anti-Malware program that find scrap, but i have to run it

In about 15 years I've seen (and fixed) about ten infections, all on computers from friends or colleagues. All those infections were with known viruses or rootkits. You might say that new viruses go unnoticed, but even if they have infected a computer, shouldn't an antivirus scanner detect it later? Yeah I know it "should", but will it? I never see anything about them. Anyway, how often do all these new viruses actually have an impact?

The "best" malware are the ones designed to be undetectable for years. Some even go so far as to play the role of an anti-virus to keep other infections out of its host. Given that most users don't bother to make sure their AV product is up to date (if working at all), it's no surprise these infections are never detected because they're actually making the computer run better (from the user's perspective) just so they can continue their own agenda undisturbed. The most advanced malware is more akin to a semi-benign parasite than a biological virus or bacteria.

I'm still finding systems with infected MBRs and hidden partitions loaded with TDSS.tdl4. How old is this rootkit now?

I think these AV companies need to figure out how to properly clean/repair a system that has already been compromised before trying to play the cat and mouse game with the malware developers. I find AV software far more useful if a late detection can be removed/repaired rather than have it sit on my system for years undetected.

ooh, that's an interesting point. I reinstalled my desktop this weekend and I know the main disk has multiple partitions (one in particular is "this space isn't usable because there's not enough to make a full block with these NTFS settings"). How do I check those?

Boot away from the hard drive (Linux live CD for example). Replace the MBR with a known-good copy. Check that the primary partition of the drive is Active, not the dinky space area. The TDL4 stuff primarily hits the MBR to bootstrap a malign active partition that it boots from. Wiping the MBR alone leaves the partition active but unable to boot. Wiping the partition alone leaves the MBR corrupted and unable to boot.

1) reboot into safe mode2) plug in USB key with known good copy of malwarebytes on it and install3) run malwarebytes and clean PC4) reboot5) update/install AV product of your choice and onto your next job

You might say that new viruses go unnoticed, but even if they have infected a computer, shouldn't an antivirus scanner detect it later?

Often enough, no. One of the things that malware will do is subvert the ability of AV to detect it. Sometimes they'll disable the antivirus entirely. Sometimes they'll just break it and make it so the AV software won't download updates. It's also common for malware to break Windows updates for similar reasons.

And part of what ends up being the problem is that it's very difficult to know for sure that you don't have a virus. It could be that you don't have a virus, or it could be that you have one that

The article mentions whitelist technology as the next step beyond conventional signature-based blacklist systems. But that's what I used three years ago, with RegRun [greatis.com]. As soon as an executable is run that it doesn't recognize, RegRun pops up an alert asking you if it's legitimate. Of course, this is useful only for the technologically savvy.

But now instead of that, I employ the ultimate in virus recovery (albeit not virus control). Using the multi-boot software BootIt Bare Metal [terabyteunlimited.com] (like a commercial version of GRUB, GParted, and other utilities rolled into one), I keep a clean OS on a separate partition that I can copy over the main partition at any time. Of course, I keep data on fileservers instead of my local hard drive.

It depends on what you call "data". You can hide a virus in a text file, but that virus will be harmless, as there's no way to execute it. But a Word file isn't just data, since you can insert a macro. IMO whoever thought of putting embedded macros in word processing documents was brain-dead stupid; a word processing document should NOT be able to infect a system. Even a spreadsheet should not be able to infect; there should be two files in a spreadsheet with macros, the data and the macros, just like a dat

Any interpreter can be used to run an exploit if the interpreter has a flaw. The seemingly huge number of flaws in interpreters shows that it is either hard or people that write software make a lot of mistakes.

An ID3 tag attack was the method used initially to jailbreak the Kindle Touch:

http://yifan.lu/2011/12/10/kindle-touch-5-0-jailbreakroot-and-ssh/

For those who don't want to actually read the article, the interface for the Touch was largely created with HTML5 apps, using Javascript. Digging into things, the jailbreak designer found that a Javascript function had been put in on the system to allow arbitrary command lines to be passed to the underlying Linux-based OS. However, when being used as a web bro

Not only are you wrong, you subsequently point out how in direct contradiction to what you wrote:

"Then there's the case of bugs in the software that reads the file,"

All viruses take advantage of bugs or poor design in executing software, and the exploit is not necessarily the propagation vector. They can, and sometimes do live in non-executable data files. They can propagate via simple file copying.

I've seen some good review on Vipre anti-virus on how it loads applications into an extremely lightweight vm that monitors calls to certain system-modifying APIs and uses heuristics to detect "unknown" malware based on malicious patterns, which it then quickly cuts off access of the VM and the malware is rendered useless.

Of the few reviews I read many years back, Vipre had in the upper 80% detection rates for unknown malware while all of the others were more in the 20%-30% ranges, and Vipre had the least

Way behind the times. Webroot took over the light factor by a huge margin (sub-MB total installer size anybody?). Instead of trying to make a spot heuristic decision about unknowns to figure if they are viruses or force them to run in a VM and not have any access to system resources (let's break legitimate stuff), or have access that is monitored and cut off, but the damage done is still there, it journals changes made by the unknown thing and if it's determined to be a problem, rolls it all back. If it

While this is a classic arms-race (i.e. each has incentive to stay one step ahead) - I would argue that there is asymmetry in the incentives in the attackers (malware writers), and defenders (anti-virus, and computer security software writers). I believe the long-term outcome of this is that the window of exposure for popular platforms will continue to grow, despite advances in: patching hosts, general user education, availability of firewalls, etc

An illustration of the basic asymmetry is this:

A lone coder in an impoverished country has a lot more to gain by writing a single virus/piece of malware than does an anti-virus company to write detection for that single virus. Think: bread for your family vs. one more item crossed off in a list of tens (if not hundreds) of thousands.

Additionally, the virus only has to be active for a short time to make the labour worth it. Write a new one every month, by the time it gets to the a/v companies, cash is in the bank.

Multiply this by the number of coders that are out of work, in countries that have other things to worry about, and the increasing availability of tools and education for the job.

Heuristics are HARD, and if you spend 3 months developing a virus you test it against the major players to see if it actually does anything.New viruses are designed to get past the current antiviruss. The only thing that a AV should guarantee is a minimal number of days until they have an update that will protect users.

I like to think of myself as being pretty good when it comes to security and AV protection. I've been using computers since the C64 era and I remember when Michelangelo was making waves, long before rootkits. I even wrote a small DOS virus in assember myself (never released it, just as a study). I don't run crap downloaded from torrent sites and all my software is licensed. I keep a Windows XP inside a VM for stuff I'm not sure about.

Last month I got infected. I got sloppy and I just run something from an unknown origin (not a crack or some crapware, a legitimate installer). Some alarm bells sounded right away in my brain (the installer should have been signed and I got a warning that Windows Security has been disabled). I spent the next 5 days running AV tests on the drive. I used Live CDs from Kaspersky and MS to boot clean. I pulled out the drive and scanned it on a clean computer. I run separate AV and Rootkit finders. They all said the system is clean but I still didn't feel right. Finally, I run Malwarebytes Anti-Rootkit and it found it! No false positive, it really was a trojan svchost.exe. Needless to say I nuked everything from orbit - repartitioned and reformatted the drive, installed everything fresh and restored my files from backup. I even changed all the passwords.

So when a 'crime' happens around you, you just kill mankind and start over again?

Or, like a reasonable person do you investigate?

What is the nature of the exploit? Virus? Malware? Data file infector? Anti-virus disabler?How did it get there? Will you reintroduce the risk by re-installing?How long was it there?How does it spread, did it infect any other computers on the network?Did it capture and send off any data on the system?Do your backups contain the virus?Was the infection caused by you? Did it come ov

It seems that by taking five days, just to find an infected svchost and then nuke it, you've successfully answered zero of those questions that you didn't already know within the first hour or two. Granted, if MBAM passes the results to their servers, it may help a tiny bit for them to study, but not really.

I even wrote a small DOS virus in assember myself (never released it, just as a study).

I did an evening course in x86 assembler at a college in the UK many years ago. In our first lesson the tutor showed us how to write a boot sector virus for DOS - I thought it was quite an amusing way to motivate us!

The question is, how well do these products protect their users? This study doesn't really help in that regard. Sure, we can dig up samples that the product doesn't detect. This is inevitable as pretty much everyone acknowledges.

A couple thoughts though. Looking at the PDF, they are deliberately going after obscure and experimental samples of malware. Fair enough, this was the purpose of the study. If they wanted to establish that AV products won't detect obscure and experimental malware samples, so far so good. But how likely is it that any normal user is going to encounter one of these? Probably very unlikely.

The AV vendors have to prioritize their time, so they will focus more on malware that a user is likely to encounter, so as to provide better protection.

Yes, the underlying point is still valid. Any automated detection technology is going to lag behind, that's a problem we will have to live with. Even products from Imperva will suffer from this, malware authors will simply run their samples through VirusTotal and all the other tools and keep tweaking until they have an approach that evades the detection.

It will require a whole new Internet to keep bad guys out. One Internet with all the lock down measures in place, and one with all the free rain and dangers that come with it. I'm thinking this will all be done by companies like Google and Microsoft. They will probably have some options in the search engine to enable this.

What about Comodo's Defender? You can set it up to automatically sandbox any suspicious programs (unsigned for example) and any suspicious behaviours will be denied and reported. Certainly it is not a silver bullet but I have had good experience with it after it detected a malware hidden in my input method program (which wasn't detected by MSE). The developer site was breached and a modified version was uploaded, comodo alerts me that the program was trying to access the internet.

Seems like we had a story about this same shit a month ago. It is still basically just scare mongering.

Yes, virus scanners are not good at brand new threats. A threat must be identified, and an update sent out before it can be blocked. Virus scanners are not magic AI boxes that can evaluate code for its intent, nor is there an "evil bit" that is set in bad code.

However, it turns out not to matter since viruses spread like, well, viruses, and virus scanners are inoculation. It is a herd immunity thing. New threats aren't on any systems, they are put up in various places to try and infect systems. They start slowly spreading. They get identified and an update sent out, and their spread is limited as potential hosts are inoculated.

Virus scanners are NOT perfect, but then no defense is. Geeks need to stop living in this fantasy land where there is perfect security. There's not. Ever. There is only layers of defense, defense in depth, to try and keep threats out and eternal vigilance.

Virus scanners are a valuable tool to help strengthen a defense. For most people they'll catch most of the threats they are likly to encounter and that is not nothing.

we have a human analogy as a starting point. If I wanted to keep something, human or otherwise, free of infection I would stick it in an hermetically sealed container. Personally, I think (and I am most certainly not a security expert) the problem we have is that users are, by and large, allowed too much freedom by default. They can wander, like horny 16 year olds, the boudoirs and dark alleys of the internet without any form of protection what so ever. The iPhone is a nice example of a locked down system w

This is exactly what Apple has done with gatekeeper in their current OSX. Users can choose 3 levels of software protection. The strictest is only to run software from the Apple store which all has a code signature key. After that level comes a restriction to run only software from trusted developers that have been issued a signature key by Apple. The final level is no restriction at all, were all software including Trojans and viruses are allowed. The default is the middle level. All iDevices from Apple are

I run a local computer repair shop, and I can corroborate this story- modern AV does jack.

I haven't seen any really malicious malware in a while, but I see ransomware and scareware ones quite often, and every time the computer has up to date AV on it.What's more, a lot of the time I've seen the virus in question several times, meaning it's been around for at least a fortnight, and still the AV guys haven't picked up on it.I can appreciate that a social engineered drive-by exploit attack is difficult to defend from, when the customer asks me how to stop it happening again, it's a tough question to answer- but this doesn't change the fact that IMHO, all anti-virus is a waste of time and money at the moment.I install MSE on customer laptops because I have to put SOMETHING there, but I have little faith that it will protect them.

Now I'm not fear-mongering here, I'm just being matter-of-fact. Three years ago when I stopped re-selling AVG, my account manager said 'Oh sorry to hear that, can I ask why?'I said; 'Because it doesn't work. I am removing trojans and rootkits from computers every day, and many of them are running AVG, which has completely failed to save them.'

Make your anti-virus software work, and make it protect users from drive-by attacks on bad facebook links (without intrusive toolbars and link checkers please), and I will sell you hundreds of copies in my little shop alone.

Um, the viruses you see infecting systems will, pretty much by definition, be the ones that get past the AV software. You won't be asked to remove a virus that the AV software on the machine will catch, because the AV software will catch it.

A: My point about a virus that's been in the wild for at least two or more weeks is still not covered stands. AV corps bang on about research and monitoring so much, why are they so slow to keep up, especially when a lot of modern viruses are relatively easy to remove?

B: AV loves to harp on about how well it's protecting you, yet you never see positive virus removals in the logs. By your suggestion, I should be seeing disinfections and removals in the AV logs on most computers. The only tim

You can't fix a human behavior problem by throwing more technology at it. Depending on AV for prevention of computer malware is like telling someone to slice themselves up with razor blades then jump into raw sewage. We have antibiotics, after all.

IMO, this is all to be expected, and hints at the true, underlying problem. The entire concept of anti-virus software developed under false pretenses.

If you read Wired magazine's lengthy story on John McAfee, for example, you learn that the guy was little more than a scammer, ever since his college years. He started out giving away "free" magazine subscriptions that he lied and told people they won, and then convinced them to pay him a "shipping and handling" charge to receive them.

He only got the idea to form his anti-virus company after reading a few news stories about the successful spreading of the first virus programs (which were really developed as an experiment to see how far they'd replicate -- not to do any damage to systems). He thought it was really scary stuff (which he claims is largely because he was beat as a child by his dad, and the idea of a computer virus suddenly attacking a machine for no known/good reason was similar in his mind).

His company only become really financially successful after he fear-mongered to the media at every turn, trumping up relatively small virus infections as "liable to wipe out entire corporations!" and so forth. (Remember, in the beginning, McAfee actually gave his product away for free - knowing home users would start recommending and/or installing the product where they worked too, and the real money was in getting companies to pay for licensing.) Obviously, others saw the flow of money and wanted a piece of that action, so they, too, started anti-virus or "computer security" companies with similar strategies.

Don't get me wrong. I'm sure there really are people in the computer security or anti-virus business with good intentions. Some people out there really DO think they've "built a better mousetrap" and aren't just trying to sell a bill of goods for easy money. But at best, this stuff is a rapidly moving target. In fact, the traditional virus is hardly even a problem anymore, since most malicious software writers have moved on to malware as more effective for their purposes. (Why try to make complicated code that secretly attaches to valid files and replicates itself at every turn when you can just trick a clueless user into voluntarily downloading and running your destructive application instead?)

Over the years, I've watched companies spend huge money on dedicated appliances that purported to be "advanced firewalls" and "intrusion prevention systems" and the like -- only to become pretty much obsolete when a new "security" company popped up and offered up a replacement solution that was more clever and relevant to the latest variations of threats. Meanwhile, how much money was REALLY saved by having any of this? That's the beauty of the scam, of course... there's no way to quantify it. You can make up all sorts of pretend statistics!

The problem with every antivirus I have ever used in my computer business, not just Norton and McAfee, is that virus is too narrowly defined. Most miss spyware and all miss scamware, which they cannot tell from legitimate competing products and shakedowns like the FBI scam. Malwarebytes or Spybot while running in safe mode are the best bet for scamware and shakedowns.

Malwarebytes isn't much different than other anti-virus products... as far as I'm aware, it uses pretty much the same methods to detect and remove. Also, the free version is only much use once the system is already infected (at least that was the case last time I checked) - you have to pay for any sort of real-time monitoring.

Part of the problem is that products that start off good and have a good reputation often lose their edge but people continue using them. I remember when Norton Utilities (or it competitor PC Tools from Central Point) was almost essential for 'power' users, and when McAfeee was amonst the best anti-virus toolkits.

Prevx joined Webroot (is Webroot now? Took over Webroot (all old Webroot code is gone)?) and while their immediate detection rate is not that great, their response time looks like it averages around 10-15 minutes automated and 1-2 hours when you get a human involved in looking.